Ch 12 'Improving Session Security'

[kwandoa]

I understand why one would use the ($_SESSION['agent']), what I would like to ask though is 

 

why , in the conditional 

 

<?

 

 

if (!isset($_SESSION['agent']) OR ($_SESSION['agent'] != md5($_SERVER['HTTP_USER_AGENT']) )) {

 

?>

 

you would use OR and not AND. I would think that you would check for both?

[Larry]

That code is looking for a point of failure, so either condition being false is sufficient. If the conditional was confirming success, it would be

if (isset($_SESSION['agent']) AND ($_SESSION['agent'] === md5($_SERVER['HTTP_USER_AGENT']) )) {

Notice three changes required:

• Removal of ! in the first condition
• Use of AND instead of OR
• Change of != to === in the second condition